Every 3 to 4 months there will be a new version of WordPress (according to the WordPress roadmap). This means that there will be a major version update (so from 4.9 to 5.0 as an example) that comes every 3 to 4 months (since most of the people who help out with WordPress are volunteers there isn’t a exact deadline to release a new version). There will be also be minor updates (from 4.9 to 4.9.1 as an example) that come out at anytime, these minor updates could be anything from a maintenance release that fixes bugs (WordPress 5.0.2 fixed 73 bugs) to a security release like WordPress 5.0.1 (most of the time it is advised that you update because not updating makes it easier for your website to be hacked).

Since WordPress 3.7, WordPress is setup to auto-update itself to ensure all sites are on the latest version and protected against hackers. By default only minor release (from 4.9 to 4.9.1) are done, but in extreme cases certain plugins and themes may be updated. This is nothing to be afraid of, it’s a good thing. If a major release comes out then WordPress won’t update, you may get email’s reminding you there is an update available (it could be from your host, from Wordfence or other plugins) but you can update when you feel ready to (and when most of your themes and plugins are compatible).